DEV Community

Cover image for Introducing nimux: A Pure-Nim Network Enumeration and Remote Execution Toolkit
blue0x1
blue0x1

Posted on

Introducing nimux: A Pure-Nim Network Enumeration and Remote Execution Toolkit

#security #nim #redteam #cybersecurity

I recently released nimux, a pure-Nim network enumeration and remote execution toolkit for authorized security assessments.

nimux is built around one idea: a single native command surface for moving from discovery to execution without constantly switching tools.

Internal assessments often require scanners, SMB tools, LDAP tools, Kerberos utilities, AD CS tooling, GPO tooling, remote execution tools, secrets tooling, DCSync tooling, ticket
converters, and SOCKS helpers.

nimux brings many of those workflows into one native binary.

Why I built it
During internal security assessments, the workflow usually moves through several phases:

  • Discover reachable hosts and exposed services
  • Validate credentials
  • Enumerate SMB, LDAP, Kerberos, MSSQL, WinRM, and other protocols
  • Identify Active Directory paths
  • Request or transform Kerberos tickets
  • Execute commands remotely
  • Move files
  • Collect secrets
  • Pivot into internal networks
  • Preserve output for reporting

The usual approach is to chain many different tools together.

nimux tries to reduce that friction.
It is not just an SMB enumeration wrapper. It is designed as a full-chain operator toolkit.

What nimux supports
nimux currently includes support for:

  • TCP and UDP scanning with service detection
  • SMB enumeration, authentication, shares, users, groups, sessions, RID brute, file operations, coercion, and ticket capture workflows
  • LDAP and Active Directory enumeration, writes, ACL paths, RBCD, Shadow Credentials, BadSuccessor, DNS, LAPS, and gMSA workflows
  • Kerberos TGT, TGS, S4U, PKINIT, ccache and kirbi conversion, ticket renewal, ticket purge, golden, silver, diamond, and inter-realm ticket workflows
  • AD CS inventory, template analysis, certificate requests, certificate authentication, certificate mapping, and ESC-style findings
  • WinRM, SCM, WMI/CIM, DCOM/MMC, scheduled tasks, helper services, and interactive shells
  • MSSQL, PostgreSQL, MySQL, HTTP, HTTPS, WebDAV, FTP, SSH, RDP, VNC, NFS, and AFP clients
  • SAM, LSA, cached credentials, DPAPI material, trust keys, and native DCSync
  • BloodHound-style output
  • Native SOCKS helper deployment and proxy-aware workflows
  • JSON output for automation

Protocol coverage
nimux currently includes clients and workflows for SMB, LDAP, Kerberos, WinRM, MSSQL, PostgreSQL, MySQL, HTTP, HTTPS, WebDAV, FTP, SSH, RDP, VNC, NFS, and AFP.

It also includes native DCSync, secrets extraction, DPAPI material collection, trust key extraction, BloodHound-style output, SOCKS helper deployment, JSON output, and rollback records for
supported AD writes.

Active Directory depth
nimux includes many Active Directory operations directly:

  • User, computer, group, and dMSA creation
  • LDAP modify, delete, LDIF, restore, and move operations
  • RBCD configuration
  • ACL add and remove workflows
  • Owner changes
  • Group membership changes
  • Kerberoast and ASREPRoast
  • Shadow Credentials
  • Certificate mapping
  • Schannel LDAP authentication
  • BadSuccessor workflow
  • GPO creation, linking, delegation, file operations, startup scripts, and scheduled tasks
  • AD CS inventory, certificate request, certificate authentication, and template modification
  • OPSEC notes for common event and log artifacts
  • Rollback output for supported writes

Kerberos workflows
Kerberos support is one of the main areas I focused on.

nimux supports kinit style TGT requests, getST style service ticket requests, S4U2Self, S4U2Proxy, constrained delegation, RBCD final service ticket workflow, ccache inspection, ccache to
kirbi conversion, kirbi to ccache conversion, ticket renewal, ticket purge, Kerberoast, PKINIT authentication, golden tickets, silver tickets, diamond tickets, inter-realm tickets, and
extra SID forging.

Pivot-aware workflows
One of the features I care about is pivot-aware usage.

nimux includes a SOCKS helper workflow and supports proxy-aware operations across supported protocols.

This makes nimux useful beyond a single flat network.

Why Nim
I chose Nim because it gives the project a strong native-tooling foundation:

  • Native binary output
  • Fast startup
  • Good performance
  • Practical systems programming
  • Strong C interoperability
  • Lower runtime friction
  • Good fit for protocol-heavy tooling

nimux is still young, but the direction is clear: a fast native toolkit with deep Active Directory and Kerberos coverage.

Install

Install from Nimble:

nimble install nimux

Download release assets:

https://github.com/blue0x1/nimux/releases

Build from source:

  git clone https://github.com/blue0x1/nimux
  cd nimux
  nimble build -y
Enter fullscreen mode Exit fullscreen mode

Documentation

The documentation includes command references, examples, tutorials, troubleshooting, and advanced Active Directory workflows.

https://docs.nimux.wiki

Legal notice

nimux is built for authorized security testing only.

Use nimux only on systems you own or are explicitly authorized to assess. The tool includes functionality that can modify Active Directory objects, request Kerberos tickets, run commands
remotely, and extract sensitive material from systems where the operator has sufficient privileges.

The author assumes no responsibility or liability for misuse, damage, or legal consequences caused by unauthorized use.

Links

Website: https://nimux.wiki
Documentation: https://docs.nimux.wiki
GitHub: https://github.com/blue0x1/nimux
Releases: https://github.com/blue0x1/nimux/releases

Update: v1.0.2 adds MCP integration

nimux now includes an MCP wrapper that exposes core nimux workflows as structured tools for AI clients. The CLI remains the native execution engine, while MCP clients can help with
planning, parsing, reporting, and repeatable workflows.

The MCP integration includes:

  • stdio-based nimux MCP wrapper
  • config examples for Codex, Claude, Cursor, Windsurf, and generic MCP clients
  • policy-aware execution model
  • structured progress and result output
  • support for workflows such as scan, SMB, LDAP, Kerberos, WinRM, GPO, secrets, DCSync, SOCKS pivoting, and proxy-aware enumeration

Docs:
https://docs.nimux.wiki/mcp-integration

Release:
https://github.com/blue0x1/nimux/releases/tag/v1.0.2

Top comments (0)